Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feat: Add support for parameterized SQL queries with argument escaping #221

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Feat: Add support for parameterized SQL queries with argument escaping #221

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
928f605
Feat: Add support for parameterized SQL queries with argument escaping
iThorgrim Jan 22, 2025
26c5164
Merge branch 'azerothcore:master' into ParameterizedSQL
iThorgrim Jan 22, 2025
ef5ded6
Merge branch 'azerothcore:master' into ParameterizedSQL
iThorgrim Jan 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions src/LuaEngine/LuaEngine.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -694,6 +694,48 @@ void Eluna::Push(lua_State* luastate, ObjectGuid const guid)
ElunaTemplate<unsigned long long>::Push(luastate, new unsigned long long(guid.GetRawValue()));
}

std::string Eluna::FormatQuery(lua_State* L, const char* query)
{
int numArgs = lua_gettop(L);
std::string formattedQuery = query;

size_t position = 0;
for (int i = 2; i <= numArgs; ++i)
{
std::string arg;

if (lua_isnumber(L, i))
{
arg = std::to_string(lua_tonumber(L, i));
}
else if (lua_isstring(L, i))
{
std::string value = lua_tostring(L, i);
for (size_t pos = 0; (pos = value.find('\'', pos)) != std::string::npos; pos += 2)
{
value.insert(pos, "'");
}
arg = "'" + value + "'";
}
else
{
luaL_error(L, "Unsupported argument type. Only numbers and strings are supported.");
return "";
}

position = formattedQuery.find("?", position);
if (position == std::string::npos)
{
luaL_error(L, "Mismatch between placeholders and arguments.");
return "";
}
formattedQuery.replace(position, 1, arg);
position += arg.length();
}

return formattedQuery;
}

static int CheckIntegerRange(lua_State* luastate, int narg, int min, int max)
{
double value = luaL_checknumber(luastate, narg);
Expand Down
2 changes: 2 additions & 0 deletions src/LuaEngine/LuaEngine.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,6 +262,8 @@ class ELUNA_GAME_API Eluna
{
ElunaTemplate<T>::Push(luastate, ptr);
}

static std::string FormatQuery(lua_State* L, const char* query);

bool ExecuteCall(int params, int res);

Expand Down
27 changes: 27 additions & 0 deletions src/LuaEngine/methods/GlobalMethods.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1334,6 +1334,10 @@ namespace LuaGlobalFunctions
{
const char* query = Eluna::CHECKVAL<const char*>(L, 1);

int numArgs = lua_gettop(L);
if (numArgs > 1)
query = Eluna::FormatQuery(L, query).c_str();

ElunaQuery result = WorldDatabase.Query(query);
if (result)
Eluna::Push(L, new ElunaQuery(result));
Expand Down Expand Up @@ -1382,6 +1386,11 @@ namespace LuaGlobalFunctions
int WorldDBExecute(lua_State* L)
{
const char* query = Eluna::CHECKVAL<const char*>(L, 1);

int numArgs = lua_gettop(L);
if (numArgs > 1)
query = Eluna::FormatQuery(L, query).c_str();

WorldDatabase.Execute(query);
return 0;
}
Expand All @@ -1402,6 +1411,10 @@ namespace LuaGlobalFunctions
{
const char* query = Eluna::CHECKVAL<const char*>(L, 1);

int numArgs = lua_gettop(L);
if (numArgs > 1)
query = Eluna::FormatQuery(L, query).c_str();

QueryResult result = CharacterDatabase.Query(query);
if (result)
Eluna::Push(L, new QueryResult(result));
Expand Down Expand Up @@ -1443,6 +1456,11 @@ namespace LuaGlobalFunctions
int CharDBExecute(lua_State* L)
{
const char* query = Eluna::CHECKVAL<const char*>(L, 1);

int numArgs = lua_gettop(L);
if (numArgs > 1)
query = Eluna::FormatQuery(L, query).c_str();

CharacterDatabase.Execute(query);
return 0;
}
Expand All @@ -1463,6 +1481,10 @@ namespace LuaGlobalFunctions
{
const char* query = Eluna::CHECKVAL<const char*>(L, 1);

int numArgs = lua_gettop(L);
if (numArgs > 1)
query = Eluna::FormatQuery(L, query).c_str();

QueryResult result = LoginDatabase.Query(query);
if (result)
Eluna::Push(L, new QueryResult(result));
Expand Down Expand Up @@ -1504,6 +1526,11 @@ namespace LuaGlobalFunctions
int AuthDBExecute(lua_State* L)
{
const char* query = Eluna::CHECKVAL<const char*>(L, 1);

int numArgs = lua_gettop(L);
if (numArgs > 1)
query = Eluna::FormatQuery(L, query).c_str();

LoginDatabase.Execute(query);
return 0;
}
Expand Down